hxxps://findomvirus[.]carrd[.]co/

Analysis

user interaction
yes
max time kernel
785s
max time network
783s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 22:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://findomvirus.carrd.co/
Sample260903-14nymstses

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (2603) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 1 IoCs

pid	Process
3628	die.exe

Loads dropped DLL 32 IoCs

pid	Process
4048	Decrypt.exe
4048	Decrypt.exe
4048	Decrypt.exe
4048	Decrypt.exe
4048	Decrypt.exe
1856	Decrypt.exe
1856	Decrypt.exe
1856	Decrypt.exe
1856	Decrypt.exe
1856	Decrypt.exe
3628	die.exe
3628	die.exe
3628	die.exe
3628	die.exe
3628	die.exe
3628	die.exe
3628	die.exe
3628	die.exe
3628	die.exe
3628	die.exe
3628	die.exe
3628	die.exe
3628	die.exe
3628	die.exe
3628	die.exe
3628	die.exe
3628	die.exe
4164	Decrypt.exe
4164	Decrypt.exe
4164	Decrypt.exe
4164	Decrypt.exe
4164	Decrypt.exe

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
179	camo.githubusercontent.com
186	raw.githubusercontent.com
173	camo.githubusercontent.com
175	camo.githubusercontent.com
178	camo.githubusercontent.com
185	raw.githubusercontent.com
174	camo.githubusercontent.com
176	camo.githubusercontent.com
177	camo.githubusercontent.com

Drops desktop.ini file(s) 16 IoCs

description	ioc	Process
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	Decrypt.exe
File created	C:\Users\Admin\Videos\desktop.ini	Decrypt.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	Decrypt.exe
File created	C:\Users\Admin\Downloads\desktop.ini	Decrypt.exe
File created	C:\Users\Admin\Documents\desktop.ini	Decrypt.exe
File created	C:\Users\Admin\Videos\desktop.ini	Decrypt.exe
File created	C:\Users\Admin\Desktop\desktop.ini	Decrypt.exe
File created	C:\Users\Admin\Pictures\desktop.ini	Decrypt.exe
File created	C:\Users\Admin\Desktop\desktop.ini	Decrypt.exe
File created	C:\Users\Admin\Documents\desktop.ini	Decrypt.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	Decrypt.exe
File created	C:\Users\Admin\Music\desktop.ini	Decrypt.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	Decrypt.exe
File created	C:\Users\Admin\Pictures\desktop.ini	Decrypt.exe
File created	C:\Users\Admin\Music\desktop.ini	Decrypt.exe
File created	C:\Users\Admin\Downloads\desktop.ini	Decrypt.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
291	api.ipify.org
328	api.ipify.org

ConfuserEx .NET packer 2 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/memory/3704-1432-0x00007FF73DC30000-0x00007FF73EA80000-memory.dmp	ConfuserEx
behavioral1/memory/3628-6853-0x00007FF62D200000-0x00007FF62E050000-memory.dmp	ConfuserEx

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png"	LockWarden.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png"	LockWarden.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3392	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329471579501274"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{4E977850-A598-4F18-9536-40EDFCB0005F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
6128	NOTEPAD.EXE
2976	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3704	die.exe
3628	die.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3704	die.exe
3628	die.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
3704	die.exe
3704	die.exe
3704	die.exe
3704	die.exe
3704	die.exe
3704	die.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3704	die.exe
208	OpenWith.exe
3628	die.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 4188	2568	msedge.exe	85
PID 2568 wrote to memory of 3392	2568	msedge.exe	87
PID 2568 wrote to memory of 3788	2568	msedge.exe	88
PID 2568 wrote to memory of 3788	2568	msedge.exe	88
PID 2568 wrote to memory of 3788	2568	msedge.exe	88
PID 2568 wrote to memory of 3172	2568	msedge.exe	89
PID 2568 wrote to memory of 3172	2568	msedge.exe	89
PID 2568 wrote to memory of 2636	2568	msedge.exe	90
PID 2568 wrote to memory of 2636	2568	msedge.exe	90
PID 2568 wrote to memory of 3328	2568	msedge.exe	91
PID 2568 wrote to memory of 2636	2568	msedge.exe	90
PID 2568 wrote to memory of 3328	2568	msedge.exe	91
PID 2568 wrote to memory of 3328	2568	msedge.exe	91
PID 2568 wrote to memory of 4200	2568	msedge.exe	92
PID 2568 wrote to memory of 4200	2568	msedge.exe	92
PID 2568 wrote to memory of 2220	2568	msedge.exe	93
PID 2568 wrote to memory of 4200	2568	msedge.exe	92
PID 2568 wrote to memory of 2220	2568	msedge.exe	93
PID 2568 wrote to memory of 2220	2568	msedge.exe	93
PID 2568 wrote to memory of 1844	2568	msedge.exe	98
PID 2568 wrote to memory of 972	2568	msedge.exe	99
PID 2568 wrote to memory of 1844	2568	msedge.exe	98
PID 2568 wrote to memory of 972	2568	msedge.exe	99
PID 2568 wrote to memory of 2272	2568	msedge.exe	102
PID 2568 wrote to memory of 4372	2568	msedge.exe	103
PID 2568 wrote to memory of 4372	2568	msedge.exe	103
PID 2568 wrote to memory of 4372	2568	msedge.exe	103
PID 2568 wrote to memory of 3800	2568	msedge.exe	104
PID 2568 wrote to memory of 3800	2568	msedge.exe	104
PID 2568 wrote to memory of 3800	2568	msedge.exe	104
PID 2568 wrote to memory of 856	2568	msedge.exe	105
PID 2568 wrote to memory of 856	2568	msedge.exe	105
PID 2568 wrote to memory of 2192	2568	msedge.exe	106
PID 2568 wrote to memory of 2192	2568	msedge.exe	106
PID 2568 wrote to memory of 2192	2568	msedge.exe	106
PID 2568 wrote to memory of 2408	2568	msedge.exe	107
PID 2568 wrote to memory of 2408	2568	msedge.exe	107
PID 2568 wrote to memory of 2408	2568	msedge.exe	107
PID 2568 wrote to memory of 4800	2568	msedge.exe	108
PID 2568 wrote to memory of 2152	2568	msedge.exe	109
PID 2568 wrote to memory of 2152	2568	msedge.exe	109
PID 2568 wrote to memory of 2152	2568	msedge.exe	109
PID 2568 wrote to memory of 4728	2568	msedge.exe	110
PID 2568 wrote to memory of 4728	2568	msedge.exe	110
PID 2568 wrote to memory of 4728	2568	msedge.exe	110
PID 2568 wrote to memory of 2636	2568	msedge.exe	111
PID 2568 wrote to memory of 2636	2568	msedge.exe	111
PID 2568 wrote to memory of 2636	2568	msedge.exe	111
PID 2568 wrote to memory of 4532	2568	msedge.exe	112
PID 2568 wrote to memory of 4532	2568	msedge.exe	112
PID 2568 wrote to memory of 4532	2568	msedge.exe	112
PID 2568 wrote to memory of 4432	2568	msedge.exe	113
PID 2568 wrote to memory of 4432	2568	msedge.exe	113
PID 2568 wrote to memory of 4432	2568	msedge.exe	113
PID 2568 wrote to memory of 740	2568	msedge.exe	118
PID 2568 wrote to memory of 4536	2568	msedge.exe	119
PID 2568 wrote to memory of 4300	2568	msedge.exe	120
PID 2568 wrote to memory of 5212	2568	msedge.exe	126
PID 2568 wrote to memory of 5212	2568	msedge.exe	126
PID 2568 wrote to memory of 5212	2568	msedge.exe	126
PID 2568 wrote to memory of 5468	2568	msedge.exe	127
PID 2568 wrote to memory of 5468	2568	msedge.exe	127
PID 2568 wrote to memory of 5468	2568	msedge.exe	127
PID 2568 wrote to memory of 5560	2568	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://findomvirus.carrd.co/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7fff7e95c188,0x7fff7e95c194,0x7fff7e95c1a0
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,903325406710423003,16095664982637661590,524288 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,9986620956723536097,13661979397256697996,262144 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,5640358751070730934,11407116055232097561,524288 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3356,i,11806080820973888737,4523274828105387490,2097152 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3360,i,7765877853814323680,3059395143460154851,2097152 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,1630496128951894977,10016125278289495102,2097152 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,7110801399673040428,9660540476928169855,2097152 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:2
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,12299232740454807947,4432767000227070358,524288 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,14286739989931495064,14000853970235167816,524288 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,17286773747690439827,3499115962900011738,524288 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,17286773747690439827,3499115962900011738,524288 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6224,i,1206010512512825864,10830641078828523730,2097152 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6456,i,15330300192292664742,1368564089063812346,2097152 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,11052614346733288439,3764451647278383563,524288 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:8
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6300,i,2483005334831280256,10312345850989028661,2097152 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4176,i,12145225541374051164,1811714725123444677,2097152 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,16093640071486990981,8820342552601155946,524288 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6440,i,12950896939074127290,17357535598837840702,2097152 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6460,i,15180577908405487553,1432908521462219697,2097152 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6416,i,16673842573599741310,11042880955542997592,2097152 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7204,i,8618104236824010079,8228044535752935907,2097152 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7436,i,2064776621171231883,2104672004321370081,2097152 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7308,i,13988078060383374399,12679441184017031390,524288 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7296,i,13937139993188954920,3651255522576929915,524288 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7280,i,8166675328734019892,13331386352606518011,524288 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7740,i,1219769473012460925,1512923180415097013,2097152 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7364,i,506498889796956218,10190369534362367436,2097152 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7232,i,8055529719513344220,14850116917903151757,524288 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:8
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,4385707175907081469,8662435486522236949,524288 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=2760,i,12806752510001701989,3259884814271084116,2097152 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7324,i,4523547060729966,13465549722924979383,524288 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:8
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7784,i,1193672222339835070,8570482403955412179,262144 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,8335150035594988626,3597560400405469944,524288 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7584,i,17737190147698705793,8865123589334428702,524288 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7808,i,5466720630496236941,12414498696916163934,524288 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:8
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,10329779499548515012,11931664149976172971,524288 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,964553724444764686,7001575682763058067,524288 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=4000,i,1746312892742886170,17314900149652801904,2097152 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=1500 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7288,i,3404145649952211931,10141233310408185843,524288 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=6192,i,11330693373597755354,11451559409733736884,2097152 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=7744 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=1304,i,16942494771538938668,2381979594169449218,2097152 --field-trial-handle=2472,i,7350359080630813665,16847984506176271439,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:988

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6008

C:\Users\Admin\Desktop\die\die.exe
"C:\Users\Admin\Desktop\die\die.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3704

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\LockWarden\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:6128

C:\Users\Admin\Desktop\LockWarden\LockWarden.exe
"C:\Users\Admin\Desktop\LockWarden\LockWarden.exe"
1⤵
- Sets desktop wallpaper using registry
PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tips.fbi.gov/home
  2⤵
  PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://tips.fbi.gov/home
    3⤵
    PID:4164

C:\Users\Admin\Desktop\LockWarden\Decrypt.exe
"C:\Users\Admin\Desktop\LockWarden\Decrypt.exe"
1⤵
PID:5760
- C:\Users\Admin\Desktop\LockWarden\Decrypt.exe
  "C:\Users\Admin\Desktop\LockWarden\Decrypt.exe"
  2⤵
  - Loads dropped DLL
  PID:4048

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x4c4
1⤵
PID:3356

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:208

C:\Users\Admin\Desktop\LockWarden\Decrypt.exe
"C:\Users\Admin\Desktop\LockWarden\Decrypt.exe"
1⤵
PID:5564
- C:\Users\Admin\Desktop\LockWarden\Decrypt.exe
  "C:\Users\Admin\Desktop\LockWarden\Decrypt.exe"
  2⤵
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  PID:1856

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\LockWarden\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2976

C:\Users\Admin\Desktop\die\die.exe
"C:\Users\Admin\Desktop\die\die.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3628

C:\Users\Admin\Desktop\LockWarden\LockWarden.exe
"C:\Users\Admin\Desktop\LockWarden\LockWarden.exe"
1⤵
- Sets desktop wallpaper using registry
PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tips.fbi.gov/home
  2⤵
  PID:6488

C:\Users\Admin\Desktop\LockWarden\Decrypt.exe
"C:\Users\Admin\Desktop\LockWarden\Decrypt.exe"
1⤵
PID:916
- C:\Users\Admin\Desktop\LockWarden\Decrypt.exe
  "C:\Users\Admin\Desktop\LockWarden\Decrypt.exe"
  2⤵
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  PID:4164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

11fe4a3b-4e69-4cb9-97ea-27b57eb33435.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\11fe4a3b-4e69-4cb9-97ea-27b57eb33435.tmp
Size 14KB
SHA256 84951c840d4b383c84d731e51e654fda7d903b519d915d2cecfc2e7fe8920af3
MD5 ce4911aafc31f74ff7b62255f9c92045
SHA1 c26544939e9c80703b4697ed498fb8260000a71e
SHA512 95991f907f5a417f5200c6c523402a10bc2c4535a10cb3472424c6ac132b94a2e72be2fdac9f409152a692b51f05823f6d9fb9a3f2630c51ce0eed5f8839e785
SSDEEP 384:xsNTO2dUzEa+YOMII3+2MIxuvzxV+Mhdp3fF:x9IalOpI3lMI4184p3fF
TLSH
T1A3623B71786CAC635DAAA545F88736139EF490A78A892F90D6ED5F0C01DF69C230FC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2b697eddcb2b07f8539bfb3652953b0a60b5fe79caaa7bafd3e57283f337ae14
MD5 941e2ecafe7396f8e97c401afcc3b3af
SHA1 31446a30ef45517406a817809c058cb4d0f8977b
SHA512 222c47ab976196c3e2f6ff28796c492c670705750f2050ae0b523f8bda0f71b8f87e5338b508def4ce9eccd960b940f81d1f8e67bc05678f8080d5f069521c97
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T1B3B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

2c99a2e0-9a68-4c57-a71a-f842505d2fdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2c99a2e0-9a68-4c57-a71a-f842505d2fdf.tmp
Size 13KB
SHA256 9791ba178b97a2509b1e47250f30752dd2c28606c89b487e8d7aa09461814fb5
MD5 f92a1f38b8d67b5d60f9d505243a3aa8
SHA1 3b458c0ae3aad5614f7b40bfa28e8e39d9e7e716
SHA512 1d10ca5ecf8804238480d442f7ef1eaf82d91f17cb789c8ab80ca224c794ae43193080fc686c425b7147911ed01a0a3d26d453824a65f0bf50852e6d799f2cae
SSDEEP 192:sxZgR3yM/jK1Ml8MkeW/fHs/M1IdpcAlJEHW6+WN1i8Qw7/YCSCDDv/IgrJ:sxZgZMeW/fHs/MGcRHb//339
TLSH
T1F352D6116A38A977CCCFD209F941BF53D6F95462A2940E44A9FC8A1C04E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 18333974e2ed6bdee67804d5719c957f6eb0cade245c01bcb4a7e80f73d49994
MD5 499a4619c68486abd17d88774966fa09
SHA1 218fc4c5a1b25e3cb83dc1b2b0e8f1d04df52925
SHA512 c3610a154faa503cb82c3a140317fcd747c6c6da4787e4420c384a61c54bf8aebf11ec3ffa61a26037d8fdea53fe1c1345e328e99be61f7900883ba2e4c10b17
TLSH
T1FAE020C814D4C31EB146A4876254470C45D13B0B93DC6B8F7704898C3063A80A3C6A71
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 164bcdfd528f237200b3963ca6f873f08a640c1a643de895681183820de71f40
MD5 b3ceda9f07c85757001436f20f732c67
SHA1 7631da2262cfcba93d65cdc04beeab58a2c67a3a
SHA512 1a504bcef480a3c4ae6d166eb3099fb23e8f01a08576bdef20772f29a5e8f9d9192d7c1045d4b4e5ddeb56eff1c3524e2886774d57e6aa6fa91fc3ba2c70240c
TLSH
T133E0268C56C9C32FE218A4C75274470C8AC13F0B9BCC7B0B170889883042980BBD29B8
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 33KB
SHA256 539628bdc4f3b107aeb78713c741ab9b5f4737532233506d8f1b1fdc4c81040c
MD5 a06c8f49a760752dc8b3ee4f217bf4fe
SHA1 2c159af5b7341c03cbce67afffafbbae2cbb7787
SHA512 af3b5c625bf4c83616c3ae1e2380df3bd35119998ca75cb96cd590c18b9227d18a03a50cf22880ddf41edd99ac7b8b9918c93a7be90d4dd3a8e6602c8e2b519c
SSDEEP 768:f+QHjwElyDV21n98SlMi1MEOV1IyItHdLqO:GOwKyD01n9RlfyTVJYRqO
TLSH
T1F7E2F15B2127014BED8CA143576EFB4FA9E374AC5609A24F547BE0AA7B8938754BD0C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 96KB
SHA256 00b42308115826481315f6a815745f8d445a89d855fa587f627b7b4388810023
MD5 89341da90f4120b2461a9bafeef01775
SHA1 90e281f4ff94fc0eaee2e876234884e16f69894d
SHA512 bb3e8fd234ec764c6450622ff2d5f2e6e777cac6006fa23b9c3e986d79b89911b9a57ebca3bb3f3e15b8437d0b305634eea968e7d8808188efca4840bf4d5112
SSDEEP 3072:OFM4gnEp7667akyq8ez5pqVo0cvK4Dhq/8fQVT:8cIwdq87ouczQR
TLSH
T1F8A312DE415A5AD9711B87D540A18F2E140288FDAE3AC206E3C7493E1D7E1BED2392DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
Size 72KB
SHA256 f101e45f4a2ef0520b98bbd7e91d139fbff8b9eaee21c31c8f32755fc2ae03e5
MD5 64f4bbfa5428bb056dd485ab77b584df
SHA1 f9999eb8559a1f84a6f1a84f3a9fd7c6e817f4c6
SHA512 40a412ee1670ffe204d12f457b06500985e328b1729897c0417a9ac0185f54932b60a8fda505e9b23e594fe6ad53852c06b16e48204615f463b90ccce07b4fc1
SSDEEP 1536:KMxjpMDtr6t0mlwBKlvDlnxvJ9/y2TD+ikgLeKXs2Qbf+n3rEl:Ko7D/vDvLG5FqJOO7El
TLSH
T18F7302C475021AAC53CF22B81E24357F2A54BF41DBADBB1572D5F9BC2B1036EB4802D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000107

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000107
Size 343KB
SHA256 07afd00bc6b13e35f702104aebea04e61d7f90b8447559279895e5f72cabd471
MD5 f39ab38ee79b1eb354356116d49017c4
SHA1 b97e8c1d90d46d372791af31561daa69e132d7c0
SHA512 01217bff1fb5b28e6d1e5e02473ea3154c97f36f87b8973da56e8ca84b636e0de2c318cedffaedf0c76ee90d3eb2e26e6689d5a973538b6f0f91bda10c7a5253
SSDEEP 6144:nQbTrYgHjNyXvc/D0GyVq9bk72B3QM/lUs7Jv2zjWriqGfkMzZh1RqXOzKY:nmTsgHHLlq72iM/mPzjWrykMzZhXqXSV
TLSH
T1177423D43C829CDEB5717D27911A93A6C213B4052D40E39377DB808A7E8B5E852FF86B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 acd44ff49e2d80b7b14b4581b3cd69612bc87abbe7350ac7a1352176480508f7
MD5 afb1c7c8c49d8fd808443e8730b1e26d
SHA1 339648602d431cd2b559f8c4fb3ac0e626d6fccd
SHA512 67b3a78da769b4c466bb25694f0225f3330b93af2dbf6c2b9d1439764f454f26326e8b59b595ec5480279289834a4d02669e6285a0dd960d3c35291be836e295
SSDEEP 96:mTzZP9KODqQnAbuAXr/flAWvkGEOslUdmPKOvsK8qi+Lep94zG8cb0gvYMq+PAZY:mvDVuWAbN3NmCOQ+icjtw7qQAxvZ8z
TLSH
T1513272F64EE25D83EB5415B53AD808E335B128D2FCBF1E6A21E0E5BE7E57791A1000B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 aa97a8209a1e77e73dcddbb76a6af5575a9a7c93d5dda1bcc737477e66254e7e
MD5 22fc20147008d725cceaf7af2dcec516
SHA1 cd5f786114041da35c5079c4d8318029655d34c2
SHA512 bbff59f48fe542b19ca06010a960400b6da99c24a94173396ce687b09a8bd5797ac586030636eef74ee9cfdf0ed91b3e9c188f8480070341eccd3877c1a4c742
SSDEEP 96:dzZPrOzqjnAbuAXrKf6AqvkGE1slUdmPKOvkK8qi+Ln94z2cb0gvYMRPAZ13Utzz:VkezAbNkbmCOo+u2tw71Av3eV
TLSH
T1903250F24EE25D83EB5416B53AD808E735B168D2FCFF0E6A21E0E5BD3E56791A1000B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59bf01.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bf01.TMP
Size 3KB
SHA256 d55738324c13a059a0f6d172a8a42b2eb93e226a89ffdf500689a21bb208de9e
MD5 d9e960a15b75b072a84170a4fe1e30a5
SHA1 41f78bb3af1a9ebcd218a9c7627733f386137a32
SHA512 bc86833c02146383298e20e4baf0488688259bc234c05e7cee6d68f6ee348235343692ababf999a652389eb8fbee36cba1371704ca3dab56de06cc4b3e566e48
TLSH
T1C2713C3B09E15DC0E7A043FC75EE1AF474B285DBFC8F4FAE51904AB4792BB224205458
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 3513b23a867d0ffad2c56821f64a4d145c79c10efbf5d224730ee90fec8cb88e
MD5 78fdfeeec9183d99fc11e0bc7b641ec6
SHA1 be71a3411ab85d77b9da58d19ed86785b1d857b0
SHA512 3f7e4fabdff2c6cad19040b027bb55c827b73b5aed445246bde21e6f3a150a6312d721239931eb8df2e23338e956f86184772e2f6f33d963880d7b6e6a526b66
SSDEEP 192:DAgf6B2Qm8+KeEgTg9gFLsciszmtvHrrGmrmBumDmt0mz74mHx:DAgf6B2Qm8+KeEgTg9gFLsciszmtvHrX
TLSH
T16CE1ABF7C3E5866DD91165F0AA186E1ACF1D0925832C3C2AC4E4AF5BE3F2471E141B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 3a5f970079fb2f7d43669ed27170947487f21261c8827df29edc004df0f564d6
MD5 70c01bd379a54f013e69e65da3af9eff
SHA1 754760495c61db5575d40e1d72e521086da79c11
SHA512 e91babe4b65af4adc34d40a00357433a258efbc5d11303ecd9e222f382c577d912f352f2f7ccaeb2191bada6a8a7249ad5f865da7ed9e2b77ffc0e55553b60eb
SSDEEP 192:DAgf6B2Qm8+BEgTg9gFLsciszmtvEGrrGmrmBkumDmt0mgme:DAgf6B2Qm8+BEgTg9gFLsciszmtvEGrv
TLSH
T1B2D19BF7C3E5866DD91165F0AA18AE1BCF190525832C3D2AC4E4AF5BE3F2471E141B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 3db16fff3d9a32b0ab51d7f15c6614121ea9f29af564cef67bfdfc44ccc8fc65
MD5 85135d03ebc48b3784f930fd6a568b57
SHA1 b984ed9fbc64ec3f460ed0b7f076c09fa8a8f354
SHA512 49867c402c24bbf4ae48cc24294a8d4b5ea70491bf8a7ab731fc12061c61d3f0722e9c287501494f26373a20e2e903ae97a286cc1183fb0f3349e663e6eaaf5a
SSDEEP 96:D/OgHu+12SGmqX+8Kzogig9gFuwufu3iEBzm9vRBc/GmrmnBtmDmt0mO+wC4Gj41:DWgHD1xGmqX+pEgig9gFRscigzm9vHcT
TLSH
T174C1ABF783B1826DDA11A5F0EA18AE1FCF180416835C396AC5E4AE57E3F2471E141B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 c937fbd6c0861bd365e2cfc354d8e2276da0bac2c49a4835cb64fc6ae1822cbf
MD5 79a36e942a3015b81192a62ac235d16a
SHA1 82165183d63bc0f7085da4b3f2e6d2730ceafa13
SHA512 bdf470a772603453ec4c44787c4bc19155d215a319263116a4160b1ad96f1125803446ff4ccfca2b259ef82df8b14f09f9966823621caf65b1d43366805d7715
SSDEEP 192:DWgHD1xGmqX+dhvVasnfEgig9gFRscigzm9vHc/GmrmBtmDmt0mzj44mgsdvgI+D:DWgHD1xGmqX+dhvVasnfEgig9gFRsciR
TLSH
T1D002AAF683E5826DD91156F0AA14AF1BCE2C0516436C386AC5E4AE8AE3F2471E151F8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 1b613260c11044355bbbd85c7d60b148c76f9c25f7547748a6b92088fdbd6e4c
MD5 0950afdc490a445b5ff9ae3aa64e1003
SHA1 71c146d536a3d6c03c191f80801724079df7e39e
SHA512 200ee9e938719f3dce97450f1ce0376e4fca015ee9991bcb94521c37f29e189966a13d4b8d7812b82474860af780bf301a5648153e90489fc2812f14be86db5f
TLSH
T176D022B31215B2B6B7BC3E8A607ABC8FCB2B30A0084BDDE4B0D0D998053146D4507285
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe59838e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe59838e.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 8edf381ce388a387dd8edfeda5ff100f6d0eacf1e871288a3e032941e42b14e1
MD5 1bf00117c0fe3fa482869e3d5dcb53a9
SHA1 88bb2db23fbbce743fa3c82b99ae0def98343940
SHA512 ea880ddf348b3ecbd56cbb94d82851e040c7fe359cdcad59696d4c8ab601ce31983626033386c802a2a8fa76c9fffeb46a815c14b56095cc39b070540358fbe6
SSDEEP 384:sxZaZq4mWeW/fHsMdjEBHbslE/C3iq+/oCKk:sSA4mWn/ffdwHbjCy3/oM
TLSH
T1C792E55265249DB3CDCBD619FD21BF53E6F85462C9910E88AAFCC92C04A67FD2207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 867da737111d03720804508e447a3a0ff8abcc4847ddd567db2149046fc46aa3
MD5 384cafd7495b0f52f2a0d82b0f50a3a8
SHA1 d5a4cb794d56d42537b4afb07239cff8047379d9
SHA512 b31855ff04314ef2f11a19ad7427da0d461b3aa22e9ebbf7d31ac19d0a6ccc1a22c23e248cd2a04b5b9ef15617aac0af762b148ecf3cb65441a0de09e7f37599
SSDEEP 384:sxZaZpmWeW/fHsMdjWBHbslE/23iq+/oCKk:sSjmWn/ffdyHbj2y3/oM
TLSH
T11E92E552662499B7CDCBD608FD21BF53D6F85062CD914E88AAFCC92C04A67FD2207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b91e745dc794c6152a1cff43ff8b8835dcbf9cec24085609e17164691aae8b2d
MD5 e450c15b96964f3174d5f089fa650f3d
SHA1 c0145ccea87c366655922ffc3d7b7aa517608238
SHA512 5d65a5cf937026951b47a91bb6600a383d53055fe423a5086f92791de2f81757652be2304ce8be16f73753258a52de68facc72cbc9870e62d8d40fbcd0bef182
SSDEEP 192:sxZgR3yM/jK1Ml8MWPeW/fHsMM1tdpmFAlJEHW6+WN1i8Qw7qax/YCeDDv/Ig59J:sxZgZuPeW/fHsMMH8RHb/l/A3l
TLSH
T1EB52D711BA386A77CCCFD209F941BF53D6F5546296940E44AAFC8A1C04E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 f408a0da25ad2a254451edf6d56f812ce38c8075a84bc923ad80fa3f33110be1
MD5 89514b7311693ce3935f82389f3fa9b8
SHA1 a5c67c28793871961e90fa19c914d4f3b6b3b50c
SHA512 63b34a45c7b22559d8538cf49ce0f266b8e4025756226dde9743b53ad415f5bfe76274cc87c8feea530ea5f6fd58f4ff42458878124af3c5e10c97f5c2206970
SSDEEP 384:sxZaZsmWeW/fHsMdjPBHbslE/23iq+/oCKk:sSemWn/ffdlHbj2y3/oM
TLSH
T13592E552662499B7CDCBD608FD21BF53D6F95062CD914E88AAFCC91C04A67FD220BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 8786bef277b03c71339598638d1eb103abf5e7095bfa1fb2a36e262d7abe55dd
MD5 35573f377e95b51b15ca5363bd9dcb98
SHA1 cb8d22ee4e70bfb36b56dcf7b41a71ab69732dd3
SHA512 d80000878c66936b696fbbc6128320bc17b5ab80c42a4aa1312fa60535ee5a5f1579cba97fdf47cbeaf4a9bef833c8abf3d2e0bd750c429a6d2a49aa70ad977a
SSDEEP 384:sxZIZsmWeW/fHsMdEPzHbslE/23bq+/oCKk:swemWn/ffd6Hbj2L3/oM
TLSH
T1F182E65266249DB7CDCAD608FD21BF53D6F95462CD510E88AAFCC91C04AA7FD2207C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 33KB
SHA256 4d8388d82116106d3085da4426beeb2066d88181558b172779adbb932e7699b2
MD5 d2fe258de87ef6b8cc6662ee2f8f200c
SHA1 6443aaf090231c49c82244ec535ad4f9ae3e9cc2
SHA512 f476e69b195a88002bbb22a6f51881334a58ef1fe6319bfcd3449f574a79d36729f5d719fd1b89ca6c34fe7bc054ee39ab7cfcec0b972f0d44a66886eb63e177
SSDEEP 384:sxZaZqVmWeW/fHsMP66s8qMpRiYnazAW8pZS15posJWeT+JjEBHbslE/A+iq+/oM:sSAVmWn/ffP4Mnc7WeT+JwHbjAT3/oM
TLSH
T157F21941A524C877CBC39D18A83D7E33DAAC50925A85CEDE5AECCD1C019D2FD6B0B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a01cf409f37e72d0082e81a7a7e5c9e746bfd194d117810fe4a100fad9bdcedc
MD5 62639c7eead968d2d12e4ec5b40ba322
SHA1 1cdc92a86bfbd92c8d05c8ccc563d6fe053fdca6
SHA512 aef1f0a2a1e4abd27a4e2e446169e96653f19351c9234ae29c2cd791974c597d3de1de3cac1e8bed3f20855bcc5fcf91d283988efad7d038567323062efef766
SSDEEP 768:Lw8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVgrow:Lw8bqn+WvSCt6u1jaCZLbWVrw
TLSH
T176D20A3B280CCB7E4F845E5DED266F962DD801CB6B988D4447FA884C03C76EA512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 3KB
SHA256 af5d4d8ad85219d78841f62390a258ee042a90e11c6f7613a014ee739fac3a70
MD5 139f1a2c7b3ba08a3377805dfeec2055
SHA1 12657d457ef2412b687bfef78abdda62ea5ac2f9
SHA512 f2ba9d1f7fd65cb4d6d24b066637bbbb4531e390949e2bdb3611e80f795af4122d113e12ed15377a09444bc0d2e2ad2d48824c92f5c2929eda50a42b3459894a
TLSH
T19451E94F4D020A56EEEC62B618B618C6337455CC56845A1F6AFC8338F8D336CAC0A665
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 2KB
SHA256 3b98455ab173bd2b407e13948d8233b37a3a1091f10a3304ef02deb64b2d632a
MD5 2ce73fd104ebd8cccfe5da571008121c
SHA1 bde3e3ffb35c7788c721ff2cab87ff99489417d9
SHA512 372b88e9178329b115755c8c0fa684fd28c97deb5167d1802285e5f2a59d7bbfcb668c40f5a4c1b517f601c1493ca12c9da1c04c49b2c7251b75e45fb7e85b12
TLSH
T1CD41A48E4E54856FEC9848B2147264B837B0C9CC2B5592271CBC233A7C4376A0A5B29C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595421.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe595421.TMP
Size 2KB
SHA256 b02a12af01a02684335d950600293fee4133efaa68f12730578d20d5530f6469
MD5 40cfd32332a5818114052283f805f452
SHA1 531b6be2847773b50d70e64b2c39ccebb1315bdd
SHA512 6904bf3bc6262a895c463cb19a538cfde1e2197d996fd3d9b537249298ae7909b9b84371ba160db0c158af68a4725a87b6f4cc9ec1793426c168da2ec6105615
TLSH
T1B341868A4E41461FE8D044730993B4A43339D90097127B47A8BC573A78A17BD6D5E1D8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 0f845c761dce4b8941e5600a7d3467b3e8505fedffac4798b56e6f39a6bb6977
MD5 2c69aff7ce7fb68b2f325738b7194482
SHA1 34e6bd79f9f2af6d8d7ef3275e51d9dc935a69a5
SHA512 ee3fb40d5076730306bb0c7d13373c91b3099ca5fe3cac2cf882dffbcc9efe9499082ba94c403fb94e29240e763f7fb5c0597fb46b697e24c3b5ac8c707f6080
TLSH
T145E020FE2DF72860BC7BE3F6247148E002597998CD86BC9F1069A1D750F3361385AC61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 2210023acce35d2bb2c990375a9672fbae29a4801a8325b29bba557e50ac1c10
MD5 0e4d3d19d9de70251b902409c0e7e65e
SHA1 e64e63a28524d5fd915a815b8345ae8cea4cb0b8
SHA512 734d444b7e55838217cdde698eb0fd519db57f74b085cd7909152c229651e3f7e27729f44aab20affaddb95b6955a01547fc2122c48c40c1de2d4cf1df085a24
TLSH
T11CA00229CA988143E41712F5D0E1E19D62208C994666333A60BC81B8886D1504A93314
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b2fa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59b2fa.TMP
Size 48B
SHA256 9123642172c287671389dfe757b8f884965abb06c4cb776351d12d84332f2487
MD5 1c8224c899c551bad455e1d532e52102
SHA1 3295f597b99740161844c601901e22e2b89d3fb1
SHA512 20e26533d70c44c605278abf56cd27a8263ff6741592c2642884852711e4a6e9df3dc8eaab2c0fc8e38749479026e9049fa74c7bda09298684a4e0435e0f95b8
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 da9635c01df3472a2c2e0fd48ed47746a51475fb3a0b31aa8859f2cd128c6646
MD5 963454b9086f1f6ad869ee5057906626
SHA1 65376894414a6bddb523298910ff14678ea87c6e
SHA512 a925c606e602fc8b1a897ad7fa135f88b860eba3a1ad8a666b521ae42348ecc5e2450afc5003f8c3aa1aa13f0971ea81df54decec0445bf8824ae4cb32f6a0a9
SSDEEP 96:KoP2Kski6ewKbqE3mK8kqyQQKFmqevY8e6:oVvGtDy
TLSH
T1EAC1E62273B7160138BE290CA6E9A537CD4236637818E56F7B7800D64E67E216DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59d8d2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59d8d2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 dcb8206f8285200c29a173a3fdab20d801c765349a5e267633ea36598da8d53f
MD5 f0026eac300ac768a7efbce6ca6f80da
SHA1 491e671197f87c16acfed89571083f4f5b2b2ffb
SHA512 ecc45dffbc2af2fb57312e6676dcaaab3bde6b37705036f021bd94c6b0246849ff29210965dc887769409dcdcb79de4000771bdab6f42b5076dde28d598e5455
SSDEEP 384:4iFtsNj8TUNTUlIRTTpw+7vEa+YOMII3+26IxuvzxV+Mhdp3fF:DFtOwgHcalOpI3l6I4184p3fF
TLSH
T131A2B4F218DB9C36D9AE5747EB7E2D138EBCC053B9455A50B7984A0CCC961BFD30A814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 59619d46598d90be7a6a2de217600692287d4bc56f34ca8faea3907ea8f1940a
MD5 21132a30d942201522bf477fdb7fa3c4
SHA1 8bb9f3b354d074fadc9339c5b8b56a4d0ed9207b
SHA512 bd94cd41edfbdd0f428ded05ea23db459561dcf7b5d503d11eadda22b78be825717ddc2aa8a219fba8f45c4174cc7ac0b21fa3c2a5641d502201cdfc823d3f63
SSDEEP 384:4iFJsNt8TUNTUlIlTTeEGvEa+YOMII3+2j+IxuvzxV+Mhdp3fF:DFJAwgIcalOpI3lj+I4184p3fF
TLSH
T119823B726C5CDD779DAAAA45F94A3613CEF450A7C98A6E90E7DC5E0C00DB29C130FC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 9faf9f029833ce2720a5563dab5a7e8915ae972fbdc613500c72efac2d377e82
MD5 2f3756fc12903c9e89568e36c1d41da2
SHA1 fd6082e60cda1f40a88e2e6a5e93aa0198919f1c
SHA512 4820106b05f527dff7b57e0e837aff106220d3e07559f3d818a10d4beed229e02f9efea4a0d2ecd23397eaf6687f58679bcaaf8c20092ef97584ac1d9928e9c4
SSDEEP 384:6sNTfTezGvEa+YOMII3+2MIxuvzxV+Mhdp3fF:6ScalOpI3lMI4184p3fF
TLSH
T1A0623A71786CAC625DAAA545F88736139EF490A78A892F90D6ED5F0C01DB69C230FC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 f421b8990396d5b7520a5ce236133274eb1623808ffc3767ec8d5a883cea67eb
MD5 3e796c7635377c1f03686a32b257de86
SHA1 6a011322d16c5f4168873c5ff436704ef8903023
SHA512 cab06d68c260d5d4d69c7a1ab1880e3d6a1936b84a9c782dfe056c1bc328137e2cb9ce0246dc6c4aa1ad8052aa5b108f18083df1b4feba661da14e7ae3d56edd
SSDEEP 384:4iFtsNW8TUNTUlIlTTew+7vEa+YOMII3+26IxuvzxV+Mhdp3fF:DFtlwgmcalOpI3l6I4184p3fF
TLSH
T168A2B4F218DB9C36D9AE5747EB7E2D138EBCC053B9455A50B7984A0CCC9A1BFD30A814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7bd29c560a8adce7abe1e6ae15a9b3a94d10ecd03dfcc5f1bf2522301d7e6113
MD5 ad6bf69e1be5aaef43ce0722585237c9
SHA1 93211aaf0178a877fb566316b4e482603ae2d120
SHA512 f9c4f43362b15e2a2c404f686122e787acef232d21d17b59945b002f982a4e64fa2854c4325256fdb3a81269ee845226189f8c806c5354472d37397e4b2550e7
SSDEEP 384:4iFFZcI+sNj8TUNTUlIRWTpw+7vEa+YOMII3+26IxuvzxV+Mhdp3fCoJ:DF9+OwgScalOpI3l6I4184p3fCe
TLSH
T1F0C2E6F218DB8C76D8AD9747EB7E2D138EBCC053B5855A40B7985A0CCC961BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 283950aa84f8f16cddf2bd5fc1f93748b8a699bf1a3f84002e6295bc29ca3e0c
MD5 80c9a2ac23cc2248e44c58fc454866c7
SHA1 138e3318fbd87f24553181879ec4fb25b4267503
SHA512 06fe18c36654bf112bbe903839297572501a6c87fd0ba780c4f9691fa26c2d15078479ea2cc6b940354466dc1f91d44efbfd1230cb140d9c2b2bd07a1b758107
SSDEEP 384:xsNTOTezGvEa+YOMII3+2MIxuvzxV+Mhdp3fF:xPcalOpI3lMI4184p3fF
TLSH
T14A623B71786CAC635DAAA145F88736138FF490A78A892F90D6ED5F0C01DF69C230FC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 d1267b4d43657c6e3cc6e78278ee80813aa7fd0fa651282884c74c4dd85803bd
MD5 07d320cca7a8b9df55967285724a6715
SHA1 2f6e8ee2f681e353e3cd255d0323e0f9c4b5a4ed
SHA512 c3379066ee59a1b07df88b33a2eae333baeea5c4b0453c75c31a9db79fa18f2c76c610b90cd9f88c6991f99eefe05536162f734985a5cdccd91736ab5932fdb2
SSDEEP 384:4iFEsNt8TUNTUlIlTTeT+7vEa+YOMII3+2eIxuvzxV+Mhdp3fF:DFEAwgtcalOpI3leI4184p3fF
TLSH
T181A2B4F218DB9C36D9AE5747EB7E2D138EBCC053B9455A50B7984A0CCC9A1BFD30A814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 fcd465b9c07bc99b622210ffd0c7fbb3a397f1156690e56f8bb3d0ebde9c85f1
MD5 b2edf949b1dec4240205af2ae793d267
SHA1 1f5ce42fa63b8057afe3c8fe0ee097e9c9429b14
SHA512 4bf3b4b2cfe442e6c413b269cb0cbc4be3fcee139442f74b50a351037f7cd8a40b31ebbc7995fbd254593630e39066f447521c23147b424ff8aeb08ba6905b7b
SSDEEP 384:4iFfZcInsNj8TUNTUlIRWTpD+MfEa+YOMII3+23IxuvzxV+Mhdp3fCoJ:DF3nOwg+salOpI3l3I4184p3fCe
TLSH
T117C2E6F218DB8C76D8AD9747EB7E2D138EBCC063B5855A40B7985A0CCC961BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 96f9459c09193f8268c8b7f038ad6d5357aead743153c1647395b5394d98dd59
MD5 34d2a1eaf6eab97a840f3beaeb09d819
SHA1 676719c0dad9d0cc4d477e34cb483f0c4dbab4b7
SHA512 fd5d0feb5bc5e8ae1ba7b53bf24330b59937417f4e364cb488e4a4199a3fcc37200deb2e5f5e9961dc5989de774914ae875a4918a260e946103062ebb0a06aef
SSDEEP 384:4iFXZcIYsNj8TUNTUlIRWTpY+MfEa+YOMII3+2WIxuvzxV+Mhdp3fCoJ:DFfYOwgVsalOpI3lWI4184p3fCe
TLSH
T18AC2E6F218DB8C76D8AD9747EB7E2D138EBCC063B5855A50B7985A0CCC961BFD30A814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 16b12cc80c03eb8b5e15a8c1d84ce7f34fccbca791cd585a02231da7d2f58ce7
MD5 0e37198407edf9e58a4da211844b75ef
SHA1 b1d8824c196432e6cec75d0025c5faf417e8b18d
SHA512 0c4062b96928dd62c5f2f822259859a4114ae903906e38a5a0822c9d32385ff656cdd9663ef76c4c635609491008e157679e4570bd0dbacb99178aba8c30ff0e
SSDEEP 384:4iFnZcIGsNj8TUNTUlIRWTpu+KzEa+YOMII3+2aIxuvzxV+Mhdp3fCoJ:DFPGOwglIalOpI3laI4184p3fCe
TLSH
T1C6C2E6F218DB8C76D8AD9747EB7E2D138EBCC063B5855A40B7985A0CCC961BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7764ea9ba2d0bcbcd785ae46efd894754f1f168926e76724b5f63d9a40c85b99
MD5 5dafa5b1bc9b744e695290667afcfb21
SHA1 75cca1a89b41e520732471477f1ce954a003c9b7
SHA512 64307bacecd428fbe25a09e7f51327f8c22acb61a1711b938f836aebc5c756ad8a7d00ccbe09fcda638766fc923613f4446d2374d4e8f99752485a9cc41c9115
SSDEEP 192:vON26Db6QmiUyW0HBa+jEOm/HoTRgldU6:vON26ukHBa+YOMIKHU6
TLSH
T10602E83568385CB79EF2AE49F88737279FD4107BD9962B84DAE81F0C00D769C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9e825ef4a6319476c6f669cf6c426efa0b4513dda74c5b8c1f13456742a2b943
MD5 a89217894977035259f9563fe1d59255
SHA1 da7f605915af02ccce8788ba937bd2c0593a7782
SHA512 81ae381742ba395894d86ef2b1dc6a910c048b5e74c8addb0746f7ee0ed943285899d2975ba4202b6de98d17096971b871d6c58b7cb2b0992792cca47a64f7cf
SSDEEP 192:nON26DbYQmiUyK0hBa+jEOm/HoI3+21NzfqfU6:nON26QShBa+YOMII3+2rIU6
TLSH
T1A3122936683C9C775DE2A595F88736138EE85067DA8A6F90D6DC1F0C00EBA9C130FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 6c6085efc990531365ac85656995ea3c69b61e55592124e68624a412b04f5671
MD5 ff85d174c29aed644f8afbb9402c6fb6
SHA1 5f422445ef6bd53edc7f36eff052a7faf9f96507
SHA512 2675a079c42f22b12965a488de87d55be73e954b499ed9c8ea4ea947a80027887cb38d30aff49ecb11c39b61c05c055342b6c9291ec68afae4461a95ed023021
SSDEEP 384:XsNTfTeGGvEa+YOMII3+2MIxuvzxV+Mhdp3fF:XvcalOpI3lMI4184p3fF
TLSH
T1A0623A71782CAC635DEAA545F88736139FF490A78A8A2F90D6ED5F0C01DB69C230FC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 0263dd09a4afc235ab02224c7267910fa446dacecf848137a0388a9212589151
MD5 4dda067a0f0b5839efcb8842f4b2ab11
SHA1 1a87005ff8086bbd44a7a81d0ae2e4411703e952
SHA512 81413a0247e5141b2972ef2e98a0b223d2c6f8c79c7ddb1ac9a117b82b6b719fa4a13109def57ee0238a5e118be3a08601076f46a340cd2098022b52b30b157d
SSDEEP 384:4iF3sNW8TUNTUlIlTTew+7vEa+YOMII3+26IxuvzxV+Mhdp3fF:DF3lwgmcalOpI3l6I4184p3fF
TLSH
T128A2B4F218DB9C36D9AE5747EB7E2D138EBCC053B9455A50B7984A0CCC9A1BFD30A814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 85bf4c0d422bdbba079d0c1d91e8b3156e83914d50197d2614652610d3ae45fd
MD5 f3a7504f4e2a1438a7fbd494b5a7a837
SHA1 bca69bf4c115b8eec0a36a2fbaf5d7f226fd18ce
SHA512 f65e3fa38e719d171c3efdec9acbd94d5c6074ec0e0564fa6d122fd1061d119a77201ad833ad6f2c9e96f9bcaf41b9dacdea5e054aaf37c3beb24288df6a6cc4
TLSH
T161E00106EB4111ADC57C477414831B342BE2C46002B143876A6146687C637802F34BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fa89e390bfb47c452b4228f0350bc181ae25f1505006ed13965a93e0f5be57b4
MD5 b04b24dc7d81fbc2d84d05d0d95da846
SHA1 8ec1d67fe5852543dd90f40b588bce7b185cc04e
SHA512 6be3ba0a25b80cfb3d7d33fb8d12cfdb46da68815990a694714c724e275aaaee90c2c06221a5f67619f7dde29a08f0a19fc6fbb8ba95480d28aaaa51c4cf5495
TLSH
T183E00106E3401179C46C437014431B241A91C05002A143875A2146687C237402E34A80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bad6454c4e44edb925b9423e4babd0e1dfaa958e5c5c7813f7747191cf841474
MD5 fe458c8fdc957f772f0c44349441c984
SHA1 10d2aca91ea9fdc4bf2d2ced8a6a250eb99a0331
SHA512 6ae134e078ef3bdf31341da8dba996820126d41d157567f1dde77740bdb7d99a409e229b47dbf37967608078824782a20552247f676c65d986dc543a43b8f2be
TLSH
T1D7E00906EB4112AAC568477414872B242BE2946002A243876A6246B87C677842E24BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b94458ba9dd0d276efeae82534107db803b6969fede3a8e38fe94bc85ac223f2
MD5 0a3171e689f25aac7098bb551370b565
SHA1 32666d0aeb29ffbc13ebe2a0ec38a5eb17e5e604
SHA512 7d51bab24ed4dd968e2f1004e874d73211464b1abe5e77d64a42b781c7500b06463c7aa85d5f6f50367bfc69ac6acd32d5fc1413dcfe60dbac2d6ef37207f455
TLSH
T152E00206975151BAD46D477414871B2527F1946053B343475A6255787C577441E34FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe595133.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe595133.TMP
Size 392B
SHA256 22301729a779b8d2655c3950116eebdb7970f7599d636a6b0f459b8d75e47000
MD5 24ed6d7c6344f235cff99104e0b5aa89
SHA1 f2455363a4b76d2481a02bc6dd8da815f53709c5
SHA512 c0f627e215ee0a96479b953a21e14ea05b591e6549016a3aef8d1818d82b8c73b1c9a06c14c3c235882608d68eb18b3efbc354eeefe1fb0aea6467b2eab923c8
MD5 SHA1 SHA512

Submit Download

274873b3-1cc6-4e4f-9d60-5d17b61927f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\274873b3-1cc6-4e4f-9d60-5d17b61927f0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4cdf0da66f0323b4b82f2e0650eacfc45a17356b357cea503bf75be568d56a8a
MD5 16e44c0853f0a60dd544b43d306c97bd
SHA1 ce39c52a70bc351fea9c3995201792d29b2c9000
SHA512 912836d7fc7805eb1fa2ae9959cb2e819a6f2fdc41dd3ec58c7848059f57a6daafebb03d0158926aadfff5bc90aa78a931cfa537dc3f69c7736a8b9c28607d0f
TLSH
T18C411788A6EA114CB3B66F5A9BF6686E087EBD771F06945E00110E4F0773B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57602\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57602\_bz2.pyd
Size 86KB
SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
MD5 28cea50945ec6972c8ec096bf562fb9e
SHA1 52c0e93d37e30503351c7878f0e041f5a207b103
SHA512 28f46b34cb59ab5b8f3791138e3d05216c7eef2b38dce035180546b22b7f0c8fab9c1ec8a6a82b219de327d752cfc89ddc289996c2135273bd3106b7a5eceb19
SSDEEP 1536:kcCxPVz7WtNyDJo7it8PWRgT6vu9zJ4iaOkx99gV8G2RbNGWC4Ij3V6yYiS9HZfC:uxPVz7D/CaOkH9gallEWC4Ij3VHTJ
TLSH
T127838E82F364A3F6F59F90B4D6850793F730BB460750A36FB24482853F12F91AE69366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57602\_decimal.pyd
Size 283KB
SHA256 1ee2247153ec6c6e5b3b49402f294b2b7325385ad489a5522e6fa9b406575e8b
MD5 bc63a4bb65d50f6de111deecd8de3457
SHA1 60ffbdc52782ddffad0c74774896159ec8eeb5d0
SHA512 60479c96b9fafb34e1c2d93970d69f53694c998cc6667fdde731e61675eb62d0a4bf875e5a3b939ebdcd7dfea8621a30d9ee30f6d7a0c7b83e058d77e36a1dd9
SSDEEP 6144:IBEAqz+G/rY2HvCnv4mrqGqqM43fIWeAxMoWl0:IuAERbvuvzVooWl0
TLSH
T14B547E96A3490CA4EF778474CA479A57F7B2B8414360D38F43A48A972F933A3673E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57602\_hashlib.pyd
Size 67KB
SHA256 9bc6ffcd2ab4ac87c4035f18b432e888d0d4a36795c97bf3f28ddf32cc34e40f
MD5 ff7c390260b2c94396abcc5323db052e
SHA1 adc7babe127c3586c81f321ad20ff87785945795
SHA512 0c99f558cbbc21ae59932fb7eae56dc956e282609da9fa4715e28eb885bb228772496dd2d08d95ee6e37743c6b908e6190da4680935b557a01e2c0261189e855
SSDEEP 1536:1PooOWZsPAJWv52zRUQIjDItFyYiS9vUfIkb2L:5xY4JWv52ziQIjDIfdJL
TLSH
T192636C86A6984056DA1382B5C4E38F43FAB0F2522B1197DF6279C1CD2F233C3577A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57602\_lzma.pyd
Size 157KB
SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
MD5 1f2c927c6f1773093e6939e0f0075997
SHA1 36b5cccb9e64405fbf460b65a2da5b18241b7087
SHA512 eeaedf6685684699202dc7c48f2a70ea4c6ed41dbd7824607eee3b1e5e7b5b90e4c7f7efc808a5d0e54534135e450d9fb7602c00e0f213da80d8563b7909f0bd
SSDEEP 3072:sJ66g4T5QW7JfyjEqkSkA51b4oznfx9mNo/Updb4IjI10CS:sUR4Tp4QPZ8N4epYOKbvv
TLSH
T1DFF34C86B794F0E6F7228C78D2624F57E6F578190320939A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57602\_socket.pyd
Size 85KB
SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
MD5 893ee6bcfa6b5a527b61eceb80257871
SHA1 9a15db53180c3a9004e119dfe9c8858b4bdca994
SHA512 b0a885c9d72468ccffd0ab0ec5a720f511a288f5117cbb6df8822ef8df4fb5f602aef112dda9f726b4ca53328964a890afd2a3becdebf8c3447e1684ae1cc34c
SSDEEP 1536:6cVuncT0XH3XAJtZypxC7XP+66wSzM/jAjI/Lb6NsQ3cs8PgMrEIjGwnyYiS9zfG:jEny2+jypxC7XPz6wSzM/jAjQOsQssV7
TLSH
T1F7835B41AA6041F6EB73C072C2679E63FB74B5C01294A35F1466C65A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57602\_ssl.pyd
Size 180KB
SHA256 12e31f50739e33b115c7e10febf1ccedeb5d9353cd539c608cc5dd164bee17a7
MD5 b9acce051643c39e5ac4c36110388724
SHA1 69f9743a13c57f699ce68270d915159aa812103b
SHA512 4b2854acd84ae8d2a89c3817bd4f901ceb61c5c83cf02ca7d0bc0936d54a4dd730b180aec7953924fd40ad6093d788876246604af6227ab33baa812bab9995a3
SSDEEP 3072:kSj0a+17gAx5pW3kfI6CMZqMK3wYLizXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/UQ:J+17gAA3QI6CM+3bLOUBDW
TLSH
T10D048C47B1946AF7D903E8F9C2234543EBB4F145332287DE48D6D6860F03746AE6A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57602\_zstd.pyd
Size 491KB
SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
MD5 256a79eff7505cc58fbf59d863c5c543
SHA1 343939f8652fc56fb338bf1ec4c4de3c697070fc
SHA512 993459b4b1f289be955940d6914873d190a9c3c8e646073e7603cd73fbd1d984d760f0e683ac11694b609de11a4084e6b9aa1cb755b1f63451255617f38e4605
SSDEEP 12288:JccWmYLKvveelCu30rz+Q2sTrWl939ruf:JccWJKvveelCu30rzc+f
TLSH
T1B1B48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI57602\base_library.zip
Size 1.3MB
SHA256 9b27cf5ac964e33cc8ffd919b6c1f083d58b4703914d5c014143ef56134d6e4b
MD5 c45e9ec79d29ec146308fbf19223735f
SHA1 e0f4a8ab872b91512a668b1defb367cac9881242
SHA512 cf12a3c5a82c51a79cad4687c02418d6c9dee478155ea6649335fa1a1db2930ccdcf28060eec9e07567c4af029c4b7f7f000fa6718bfa1b3fe292055f2d42042
SSDEEP 24576:JlbduUFtoLUdiDQeOdP2m2dfU3yLRpjPaUb:NuUF7dG/s3wRZFb
TLSH
T11A552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57602\libcrypto-3.dll
Size 5.0MB
SHA256 8b27ebae75cc99f20075322446af36c9ffcb4e3b400a77d712ef43f007f47f7d
MD5 9751638ed5684f53f07ef6b4c7e8a786
SHA1 896a535cb1e49daa88e9aea693f52926c7e6f1a4
SHA512 b461c99c6115be95baac937f07038decd5ab2917aaaf12df8d1a44b1bc4ab28cde5ef748d1575d33b18d5e46d67f4ebc9c30333f3974c349c6f8a3c4edd86472
SSDEEP 98304:1H+q/MS7XFmXiTpdFGUPB1CPwDvt3uFlDC5g:J9/7XFmXwpdFGU51CPwDvt3uFlDCS
TLSH
T145367B6AA7A80189E4BAC13CC9534613D2B1F85A57B097CF18A156BD0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57602\libssl-3.dll
Size 776KB
SHA256 56dd50fb903b860ace831d0cd6c6250cd57e8655867c3a0fa16eac2d4cc0ba0b
MD5 a643b4a012da0d4b5653a01a458cabb7
SHA1 4e788bee34f620e671f426cc356e846c5ef51db8
SHA512 d8ac85fbf3dccb071d6fa4349d9af08116e1057da127016fcda45c9b643e4e1ef4166e0b6ef3d64f2e4d6e9a6f06122f2f8aec7fe2d5916e820b079148ff533f
SSDEEP 12288:ORPyn2nh9MXVkVJ1Ylrl3cfXJaizeTWMldFe9XbBR:wPXnh9MX2V3Ylp3cfXJaizCFe9XbBR
TLSH
T1BAF45CADB37805DCD8B6C17986934623E3B6F4562330EBEB0651C6790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI57602\python314.dll
Size 6.5MB
SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
MD5 49232f3b18bf5e2c2bd8ae0c9ad99913
SHA1 7d69e9b82972a41e69d3558868229b8b004ce534
SHA512 72a98bfd6771d0136848f4ba3f639b81a4b6d48b6d820b1495167819e5ec86fe763029c3e8e1c74d68310e08ba1dab4a0a11b3cf6acd72912740144a1ad64af4
SSDEEP 98304:vnKFXcgNEs5c00S048PePvOh0evvlHDMiEiV9:vnKFXcgNw00S0487Ei/
TLSH
T13B668D26737501A5D9BB8035C9034687DBB1BC00AB30D34B49A47ADA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57602\select.pyd
Size 32KB
SHA256 8c3ee20776d8eb7c441f2006ed46b9ba932060c6b66df4c1e156dcf7738d56ce
MD5 9e31eff5c36a868a6010be873e0f58b5
SHA1 9cdc5190fd0d821b5b22f53c8a86c62b7e64642e
SHA512 b5cee6769f229874e5905d80699975fcf9472dfa2d09f01c38d2d41872885a3e6853cf6599ec214c66e9431e6ccde95e7324f1eba860f68fe849f75497447ea4
SSDEEP 768:rB7YKHfIaqFEIjRGOyYTegc2Ip42Txf1ml9dHb7Ls/HV:rB73/IaqFEIjRGOyYiS92fIbHbns/1
TLSH
T189E27DCA6B345047E6A3C57185A2DE83FA39F7A39A11869F31B6918D0E137C1B337358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI57602\unicodedata.pyd
Size 740KB
SHA256 a7a2bfeed5d0480d8c458b3a61ee32c478ae10c694e8be61c3ba0e8cc2a6e1c6
MD5 624ffa84aa15efced4c1fd8e5ccf0b95
SHA1 2c08e87703b662828be085b4fe07e5b28b723e8a
SHA512 8f531ade03ad048c5f9d1de307e45960822e2dfd50bb27a71173a7ccb90f1a49028b70848046d34b81f130341cae4d7853db171f3167554e8c0c5a2cad40cc61
SSDEEP 12288:xPYzAPtrZmDtBPcH+dEYJ5EIub+z70lDJPT36mwtNh+:xPY05ZmDPqO54lDJPTMNh+
TLSH
T1D3F4F5F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shortcuts.ini.win.ini.iBYdos

Path C:\Users\Admin\AppData\Roaming\NTInfo\die\shortcuts.ini.win.ini.iBYdos
Size 1KB
SHA256 003b919bcca72109dacc2c77c986966e7dd9c98435e88c821a96b03497442d44
MD5 77d0895c386edb83aea222c24e718357
SHA1 70f6f198665c0386127676d968193022f2d84ea5
SHA512 7bd59f4a24ce8500c8d0876d7fc4c459cc2072f71c10b16da16dff1f24602c598a408f87768f8b3b0146157af94f10d66bc001aa127c46c0db3b72a8dcfd123d
TLSH
T12531F84AA5082B0DA04FE3E2C2B286442D963D8C989FEC729964945F4872CDF07DB10A
MD5 SHA1 SHA512 TLSH

Submit Download

die.ini

Path C:\Users\Admin\Desktop\die\die.ini
Size 3KB
SHA256 0c9cbd2784997ef05d5f20d1121979512e62ce9e45bc601f1ec3d076aceba588
MD5 08920e20f2cd483560c237b992ddb465
SHA1 6af722c47b235f2f5e4cb0c60a12ebd5d36eafcb
SHA512 b0c03f79cc97322ff7c3f8c49d2758ff6daa8d3600c3ac0b4e32d29d8a4857701e77034ebdc524413563b50a160395679f15ec7dcb1c2783e356af0279b2e47c
TLSH
T14281CAE3207803F7C7B71EAD85D3D09D1B07B4DE68D1C828AAE88275282C9BF3495975
MD5 SHA1 SHA512 TLSH

Submit Download

die.ini

Path C:\Users\Admin\Desktop\die\die.ini
Size 3KB
SHA256 4a42411e78ec0222a5835b177642ab247f6ca75dd3061dfd3ac5d945062e746b
MD5 f595cfa1066a2e341eee6cd598814499
SHA1 91f450f8ac9ab138c8a0fad2d90da33e41479b37
SHA512 ad8058305d12d1bb90f85932954c285174a13b653876cc40d1aa419b8c559ed030edd49c80584eea10c12c7cb55823c9f5eca9fe840844c548db0a4be379e8e2
TLSH
T14281CAE3207803F7C7B71EAD85D3D09D1B07B4DE68D1C828AAE88275282C9BF3495975
MD5 SHA1 SHA512 TLSH

Submit Download

die_win32_portable_3.21_x86.zip.crdownload

Path C:\Users\Admin\Downloads\die_win32_portable_3.21_x86.zip.crdownload
Size 21.9MB
SHA256 7d7195f757c45f6b69364d167c9958fa60339d53876a87e4a1edbcbf67d1e477
MD5 bbb508a4de2ca6bf25624b46ded921b3
SHA1 84b8a9719b380b612319cb18ea4abbdf53eefbbb
SHA512 697e5e3d96886a14b05ecc20c8aec7671061fadd80a078051aed0e6a75feaad9b4dab0405bca73e586cb123183e1e2086ee473202d10d3e69fd7acee00ef9f71
SSDEEP 393216:Hk/mONRnIqmi/FQSbyZ8KxLy7vl2yjFbqMV3IGWdKRbS:HiXDV/kGaLyR24FbqC/RbS
TLSH
T18737335AF21A2347C0AFDBFF209B517AAF54855B42F8E31B076924146E836D11F3A70B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

die_win64_portable_3.21_x64.zip.crdownload

Path C:\Users\Admin\Downloads\die_win64_portable_3.21_x64.zip.crdownload
Size 24.0MB
SHA256 078f2934f267392247f9c7b759a1c2457a48bc2000b25b80c2f129955ee4a3b9
MD5 039c279693597cecb3c2a67786a92149
SHA1 5343f3785f971ef9211b225d4bd5c0fe78a090ab
SHA512 b0ca7cb1f20f6d8ed73b9390d143d7bd098db77580eda95aa53351135461a1dc422ca83cebb2f9cf56edea1be591e008d577a4b6d83da64167d03113544b176a
SSDEEP 393216:XkNWJN+ZDfJt3fTodgqpeLT4rBbEzxrcG14aG8MzuFUEq9Ee7ejH1OtMlLc9lvIn:XcMgJJt3fT5q4Hr8aLIvZSLk0Kyi8f
TLSH
T1B247335AE6192347C0AFDBBF24DB8279EF54806F02B9E327076964552E836C11F3970B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResizeOptimize

Path C:\Users\Admin\Music\ResizeOptimize
Size 346KB
SHA256 8446249bcbdb6e94c45741a78c837d358b71a2bdffc03a149d055d27e8c8a3cf
MD5 440eae4c569287cd01894af116e673cc
SHA1 84c89b4e3c20b32d0b9cf09a1e4366205f8c6164
SHA512 680e039da05c073b39237c342b972db0bd60ce18b301d728bd8f03091ecb2630f45ef5a1541decf6ca47a57cf57850785fd8c00e732142ea5c308dfaf3a0fcc8
SSDEEP 6144:MMHn0hVBQFmCBB1tO2GNVwgaq7yrCYYbaBHyxUTdi4dkt624oJ6JKyz0m5BpUu7h:MMH0hXCIwt6UTddL24PprbFR6FE
TLSH
T1EE74238011BC714CABB84E9BC62C747AA17B772BD4AC832CED0658956ACFD7BD60CC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3628-6854-0x00007FFF7BF80000-0x00007FFF7C4C1000-memory.dmp

Download

memory/3628-6865-0x0000020D73FE0000-0x0000020D745A6000-memory.dmp

Download

memory/3628-6853-0x00007FF62D200000-0x00007FF62E050000-memory.dmp

Download

memory/3704-1496-0x000002712B100000-0x000002712B7BB000-memory.dmp

Download

memory/3704-1455-0x000002712B100000-0x000002712B7BB000-memory.dmp

Download

memory/3704-1457-0x000002712B100000-0x000002712B7BB000-memory.dmp

Download

memory/3704-1461-0x000002712B100000-0x000002712B7BB000-memory.dmp

Download

memory/3704-1479-0x000002712B100000-0x000002712B7BB000-memory.dmp

Download

memory/3704-1480-0x000002712B100000-0x000002712B7BB000-memory.dmp

Download

memory/3704-1432-0x00007FF73DC30000-0x00007FF73EA80000-memory.dmp

Download

memory/3704-1433-0x00007FFF79330000-0x00007FFF79871000-memory.dmp

Download

memory/3704-1481-0x000002712B100000-0x000002712B7BB000-memory.dmp

Download

memory/3704-1505-0x000002712B100000-0x000002712B7BB000-memory.dmp

Download